The Verus-Ethereum Bridge lost about $11.58 million in digital assets this week after attackers exploited a security hole in the cross-chain protocol. Blockchain security firm Blockaid flagged the ongoing attack on May 18, warning teams to pause operations. It's the latest in a string of DeFi hacks that have already cost protocols over $20 million this month alone.
How the exploit happened
PeckShield tracked the stolen haul to roughly 103.6 tBTC, 1,625 ETH, and 147,000 USDC. The attacker swapped those assets into 5,402.4 ETH — worth around $11.4 million at the time — and parked the funds in wallet 0x65Cb8b128Bf6e690761044CCECA422bb239C25F9. The drainer's own address, 0x5aBb91B9c01A5Ed3aE762d32B236595B459D5777, was initially seeded with 1 ETH via Tornado Cash about 14 hours before the exploit. That timing suggests careful preparation.
Bad week for bridges
The Verus incident comes just three days after THORChain halted trading following a breach of one vault that drained over $10 million in protocol-owned funds. User balances on THORChain weren't affected, but the back-to-back hits highlight how vulnerable cross-chain infrastructure remains. According to DeFiLlama data, 12 DeFi protocols were attacked in May 2026 before Verus, with collective losses exceeding $20 million.
April set a brutal record
May's tally is still climbing, but it's nowhere near April's carnage. Last month, DeFi protocols lost over $606 million across 12 incidents. The biggest single hack of 2026 so far was the KelpDAO bridge drain of $292 million in April. That means bridge exploits alone have accounted for hundreds of millions this year — and the attacker's wallet from the Verus heist still holds the stolen ETH.
Verus hasn't publicly confirmed a timeline for a post-mortem or any recovery plan. The funds remain in the identified wallet, and no arrest or freeze has been reported. With the attacker's initial funding traceable through Tornado Cash, investigators may have a thread to pull — but for now, the money sits untouched.
